Use strong params for users#update_password
Use strong params for users#update_password

This wasn't strictly breaking anything, but it was a home spun implementation
for params whitelisting, so might as well be consistent with the current
standard strong params approach.

NOTE: this is the controller action for when a user voluntarily changes their
password as opposed to has their password expired and is required to change it.

alphagov/signonotron2,alphagov/signonotron2,alphagov/signonotron2,alphagov/signonotron2